Skip to content
OpenAdvisories

Product · CoopCycle

coopcycle-web

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.6
    CVE-2026-121945

    CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint

    CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /ap…

    CoopCycle coopcycle-web